I recommend using the SA-cim_vladiator (https://splunkbase.splunk.com/app/2968) app to confirm your data is CIM-compliant.  Add EVAL and FIELDALIAS settings to props.conf to create CIM-compliant fields as needed.  ... View more

Hi @fedayn05, Which versions of Splunk Enterprise and Splunk Enterprise Security do you have installed? Splunk Enterprise 9.0.1 deprecates and Splunk Enterprise 10.0 disables the REST API search/parser endpoint used by earlier versions of Splunk Enterprise Security to validate the data models used by the threatmatch modular input. If you're running Splunk Enterprise 10.0, ensure you're also running Splunk Enterprise Security 7.3.4 or a later version of Splunk Enterprise Security compatible with Splunk Enterprise 10.0 and the v2 REST API. ... View more

Depends on what you mean by "disk". Data? Config? Generally this boils more or less to "install and restore config/data" and will have more or less the same result. ... View more

Is the splunkd still up and running or is it also crashed? ... View more